Menu

Individual skill

osint-investigator

0upvotes

Conduct ethical open-source intelligence investigations using public data — for due diligence, incident enrichment, and brand protection.

skills/osint-investigator/SKILL.md

Read pinned source

Source commit faf37c0859ebf627bfcb5225e8057d088691e0ae

What was checked

Matches the observed repository HEAD
Yes
Scanner rules are current
No
Repository scan complete
No
Skill scan complete
No
Observed behavior
Not checked yet
Last checked
Nov 8, 2026

These are observations at the recorded commit, not a guarantee of safety. Review the source before running it.

Install this skill

Choose an agent in your Stack or copy a command below. Commands fetch the pinned commit and copy only this skill directory. Existing destinations are refused. Copying a command does not install anything.

An install command is unavailable: current rules, complete repository and skill scans, an eligible behavior level and a permitted license are required.

Repository context

Repository stars (not skill ratings)
54
Repository last updated
Oct 10, 2026
License
MIT

Observed agent integration: No specific integration evidence. Standard SKILL.md installation does not imply verified compatibility.

Files and excerpt

File metadata and permitted, redacted excerpts come from the recorded scan. Source links are pinned to that commit.

Browse files
Read excerpt

## Overview

OSINT (open-source intelligence) is the collection and analysis of **publicly available** information: DNS and certificate records, public code repos, social media, breach datasets, company filings, and more. Defenders use it for incident enrichment, executive due diligence, brand/typosquat monitoring, and third-party risk — all without touching anyone's private systems.

This skill covers ethical OSINT methodology: passive collection, source verification, and documentation. It explicitly excludes accessing non-public data, pretexting, or any technique that crosses into unauthorized access.

OSINT is a tradecraft of patience: the answer is usually public, but buried under noise, misdirection, and stale data. Professionals distinguish themselves through source criticism — asking of every find who published this, when, why, and what would disprove it — and through disciplined documentation that lets others verify the trail.

## When to use

- Enriching an incident: is this domain/IP known-malicious? Who registered it?
- Executive and vendor due diligence from public records.
- Brand protection: typosquat domains, fake social profiles, leaked credentials.
- Attack-surface discovery on your *own* assets (cert transparency, exposed repos, public buckets).
Back to top